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, We give a proof that entanglement purification, even with noisy apparatus, is 

sufficient to disentangle an eavesdropper (Eve) from the communication channel. 

; Our proof applies to all possible attacks (individual and coherent). Due to the 

quantum nature of the entanglement purification protocol, it is also possible to use 
3 ■ the obtained quantum channel for secure transmission of quantum information. 

<: 
m : 

^_ : I. INTRODUCTION 

> : 

Quantum communication exploits the quantum properties of its information carriers for 
q ■ communication purposes such as the distribution of secure cryptographic keys in quantum 
cryptography |2| and the communication between distant quantum computers in a network 
||. A central problem of quantum communication is how to faithfully transmit unknown 
quantum states through a noisy quantum channel M. While information is sent through 
. such a channel (for example an optical fiber), the carriers of the information interact with 
Q-i! the channel, which gives rise to the phenomenon of decoherence and absorbtion; an initially 
\ pure quantum state becomes a mixed state when it leaves the channel. For quantum commu- 
nication purposes, it is however necessary that the transmitted qubits retain their genuine 
quantum properties, for example in form of an entanglement with qubits on the other side 
of the channel. 

. ^ | In quantum cryptography, noise in the communication channel plays a crucial role: In 

^ ■ the worst-case scenario, all noise in the channel is attributed to an eavesdropper, who ma- 
nipulates the qubits in order to gain as much information on their state as possible, while 
introducing only a moderate level of noise. 

To deal with this situation, two different techniques have been developed: Classical pri- 
vacy amplification allows the eavesdropper to have partial knowledge about the raw key 
built up between the communicating parties Alice and Bob. From the raw key, a shorter 
key is "distilled" about which Eve has vanishing (i. e. exponentially small in some chosen 
security parameter) knowledge. Despite of the simple idea, proofs taking into account all 
eavesdropping attacks allowed by the laws of quantum mechanics have shown to be techni- 
cally involved [||, |6], [/]]. Recently, Shor and Preskill || have given a simpler physical proof 
relating the ideas in || [| to quantum error correcting codes || and, equivalently, to one- 
way entanglement purification protocols. Quantum privacy amplification (QPA) pD | , on 



the other hand, employs a two-way entanglement purification recurrence protocol [ITTJ that 
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eliminates any entanglement with an eavesdropper by creating a few perfect EPR pairs out 
of many imperfect (or impure) EPR pairs. The perfect EPR pairs can then be used for se- 
cure key distribution in entanglement-based quantum cryptography H, pTA [L2[ . In principle, 



this method guarantees security against any eavesdropping attack. However, the problem 
is that the QPA protocol assumes ideal quantum operations. In reality, these operations 
are themselves subject to noise. As shown in [O, 



n mi 



there is an upper bound F max for 
the achievable fidelity of EPR pairs which can be distilled using noisy apparatus. A priori, 
there is no way to be sure that there is no residual entanglement with an eavesdropper. This 
problem could be solved if Alice and Bob had fault tolerant quantum computers at their 
disposal, which could then be used to reduce the noise of the apparatus to any desired level. 
This was an essential assumption in the security proof given by Lo and Chau |16| . 

In this paper, we show that the standard two-way entanglement purification protocols 
alone, which have been developed by Bennett at al. [11], [L7] and later by Deutsch et al. fllPf , 
with some minor modifications to accomodate certain security aspects as discussed below, 
can be used to efficiently establish a perfectly private quantum channel, even when both the 
physical channel connecting the parties and the local apparatus used by Alice and Bob are 
noisy. 

In Section II we will briefly review the concepts of entanglement purification. Section 
| will give the main result of our work: we prove that it is possible to factor out an 
eavesdropper using EPP, even when the apparatus used by Alice and Bob is noisy. We 
conclude the paper with a discussion in Section (TV]. 



II. ENTANGLEMENT PURIFICATION 



As two-way entanglement purification protocols (2-EPP) play an important role in this 
paper, we will briefly review one example of a a recurrence protocol which was described 
in [ 10 1 , and called quantum privacy amplification (QPA) by the authors. It is important to 



note that we distinguish the entanglement purification protocol from the distillation process: 
the first consists of probabilistic local operations (unitary rotations and measurements), 
where two pairs of qubits are combined, and either one or zero pairs are kept, depending 
on the measurement outcomes. The latter, on the other hand, is the procedure where the 
purification protocol is applied to large ensemble of pairs recursively (see Fig. ([!])). 
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FIG. 1: The entanglement purification protocol (a) and the entanglement distillation process (b). 



In the quantum privacy amplification 2-EPP, two pairs of qubits, shared by Alice and 
Bob, are considered to be in the state Pa 1 b 1 <8> Pa 2 b 2 - Without loss of generality (see later), 
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we may assume that the state of the pairs is of the Bell-diagonal form, 

Pab = + B |*")(*"| +C\ty + )(ty + \ +D\$-)(<f>-\ . (1) 

Following pi, the protocol consists of three steps: 



1. Alice applies to her qubits a it/ 2 rotation, U x , Bob a —ir/2 rotation about the x axis, 

2. Alice and Bob perform the bi-lateral CNOT operation 

BCNOT^g = CNOT^ ® CNOTg 

on the four qubits. 

3. Alice and Bob measure both qubits of the target pair A2B2 of the BCNOT operation 
in the z direction. If the measurement results coincide, the source pair A\B\ is kept, 
otherwise it is discarded. The target pair is always discarded, as it is projected onto 
a product state by the bilateal measurement. 

By a straigtforward calculation, one gets the result that the state of the remaining pair 



is still a Bell diagonal state, with the diagonal coefficients [10 



_ A 2 + B 2 _ 2CD 

A ~ B ~ ~JT (9) 

= C 2 + D 2 D , = 2AB U 

N ' N 

and the normalization coefficient N = (A + B) 2 + (C + D) 2 , which is the probability that 
Alice's and Bob's measurement results in step 3 coincide. Note that, up to the normalization, 
these recurrence relations are a quadratic form in the coefficients A, B, C, and D. These 
relations allow for the following interpretation (which can be used to obtain the relations (^) 
in the first place): As all pairs are in the Bell diagonal state ([TJ), one can interpret A, B, C, 
and D as the relative frequencies in the ensemble of all pairs of the states |$ + ) , \^~) , |^ + ) , 
and |$~), respectively. By looking at @) one finds that the result of combining two |$ + ) 
or two I 1 !/") pairs is a |$ + ) pair, combining a \^ + ) and a |$~) (or vice versa) yields a 
|^/~) pair, and so on. Combinations of A,B,C, and D that do not occur in @, namely 
AC, AD, BC and BD, are "filtered out", i.e. they give different measurement results for 
the bilateral measurement in step 3 of the protocol. We will use this way of calculating 
recurrence relations for more complicated situations later. 

Numerical calculations 0] and, later, an analytical investigation |Tj| have shown that 
for all initial states ([[]) with A > 1/2, the recurrence relations (Q) approach the fixpoint 
A — 1, B — C — D — 0; this means that given a sufficiently large number of initial pairs, 
Alice and Bob can distill asymptotically pure EPR pairs. 



III. FACTORIZATION OF EVE 



In the previous section it has been assumed that Alice and Bob have perfect apparatus at 
their disposal, which they use to execute the protocol. For the following security analysis, we 
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shall consider a more general scenario where this assumption is abandoned. As mentioned in 
the introduction, there is an upper bound -F max for the attainable fidelity of the distilled pairs, 



when the apparatus used by Alice and Bob is noisy |13], TA\ . For quantum cryptography the 
question arises: can these imperfect pairs still be used for secure key distribution? 

In this section we will show that 2-EPP with noisy apparatus is sufficient to factor out 
Eve in the Hilbertspace of Alice, Bob, their labs and Eve. For the proof, we will first 
introduce the concept of the lab demon as a simple model of noise. Then we will consider 
the special case of binary pairs, where we have obtained analytical results. Using the same 
techniques, we generalize the result to the case of Bell diagonal ensembles. The most general 
case of correlated non Bell-diagonal can be reduced to the case of Bell diagonal states |19|. 



A. The effect of noise 

In this section we will answer the following question: what is the effect of an error, 
introduced by some noisy operation at a given point of the distillation process? To keep the 
argument transparent, we restrict our attention to the following type of noise: 

• It acts locally, i. e. noise does not introduce correlations between remote quantum 
systems. 

• Noise is memoryless, i. e. on a timescale imposed by the sequence of steps in a given 
protocol, there are no correlations between the "errors" that occur at different times. 

The action of noisy apparatus on a quantum system in state p G B(7i) can be formally 
described by some trace conserving, completely positive map. Any such map can be written 
in the operator-sum representation [| 



P ^j2 A iP A i ( 3 ) 

i 

with linear operators that fulfill the normalization condition £\ AA^ = 1. The operators 
Ai are the so-called Kraus operators [|(J . 

As we have seen above, in the purification protocol the CNOT operation, which acts on 
two qubits a and b, plays an important role. For that reason, it is necessary to consider 
noise which acts on a two-qubit Hilbert space H = C 2 a ®Cl Eq. (|) describes the most 
general non-selective operation that can, in principle, be implemented. For technical reasons, 
however, we restrict our attention to the case that the Kraus operators are proportional to 
products of Pauli matrices. The reason for this choice is that Pauli operators map Bell states 
onto Bell states, which will allow us to introduce the very useful concept of error flags later. 
Eq. (^|) can then be written as 

Pat - £ /^MWW 6 ) , (4) 

with the normalization condition Y%v=of^ = 1- Note that Eq. (||) includes, for an ap- 
propriate choice of the coefficients f^, the one- and two-qubit depolarizing channel and 
combinations thereof, as studied in [14]]; but it is more general. Below, we will refer to 
these special Kraus operators as error operators. 
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The coefficients f^ v can be interpreted as the joint probability that the Pauli rotations a M 
and <t„ occur on qubits a and b, respectively. For pedagogic purposes we employ the following 
interpretation of (f|): Imagine that there is a (ficticious) little demon in Alice's laboratory - 
the "lab demon" - which applies in each step of the distillation process randomly, according 
to the probability distribution f^, the Pauli rotation and a v to the qubits a and b, 
respectively. The lab demon summarizes all relevant aspects of the lab degrees of freedom 
involved in the noise process. 

Noise in Bob's laboratory, can, as long as we restrict ourselves to Bell diagonal ensembles, 
be attributed to noise introduced by Alice's lab demon, without loss of generality. It is also 
possible to think of a second lab demon in Bob's lab who acts similarly to Alice's lab demon. 
This would, however, not affect the arguments employed in this paper. 

The lab demon does not only apply rotations randomly, he also maintains a list in which 
he keeps track of which rotation he has applied to which qubit pair in which step of the 
distillation process. What we will show in the following section is that, from the mere content 
of this list, the lab demon will be able to extract - in the asymptotic limit - full information 
about the state of each residual pair of the ensemble. This will then imply that, given the 
lab demons knowledge about the flags, the state of the distilled ensemble is a tensor product 
of pure Bell states. Eve cannot not have information on the specific sequence of Bell pairs 
(in addition to their relative frequencies) — otherwise she would also be able to learn, to 
some extent, at which stage the lab demon has applied which rotation. 

From that it follows that Eve is factored out, i. e. Alice and Bob describe their pairs with 
the state 

PABEL = (E |By>AB<flwl ) ® & ( 5 ) 

It remains to be shown that the same argument applies to a realistic scenario where the 
lab demon is replaced by some "real" noise source. To be specific, in the following argument 
we show that all quantum or classical devices that share the same noise characteristics are 
equally secure. First we note that a communication protocol is secure if and only if there 
exists no eavesdropping strategy; this fact can, in priciple, be determined by cooperating 
communication parties. On the other hand, all devices with identical noise caracteristics 
are quantum mechanically described by the same completely positive trace conserving map, 
so that a initial state pi is mapped onto a final state pf, independend from the physical 
realization of the map. This means that there is no way do distinguish the devices by only 
looking at the input and output states. For the case of noisy apparatus that is used for 
entanglement purification we get thus the following result: a device the implements (f|) 
with a lab demon cannot be distinguished from any device that introduces noise due to 
some "real" noise source; in particular, the devices must lead to the same level of security 
(regardless whether or not error flags are measured or calculated by anybody): otherwise 
they would be distinguishable. 

In order to separate conceptual from technical considerations and to obtain analytical 
results, we will first concentrate on the special case of binary pairs and a simplified error 
model. After that, we generalize the results to ensembles which are diagonal in the Bell 
basis. 
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B. Binary pairs 

In this section we restrict our attention to pairs in the state 

Pab = A\^) ab (^\+B\^) ab (^\, (6) 

and to errors of the form 

M,^G{0,1} 

with Uq^ = id'- 1 ' 2 -' and [/{ = a x ^ 1,2 \ Eq. (^) describes a two-bit correlated spin-flip 
channel. The indices 1 and 2 indicate the source and target bit of the bilateral CNOT 
(BCNOT) operation, respectively. It is straightforward to show that, using this error model 
in the 2-EPP, binary pairs will be mapped onto binary pairs. 

At the beginning of the distillation process, Alice and Bob share an ensemble of pairs 
described by (Q). Let us imagine that the lab demon attaches one classical bit to each pair, 
which he will use for book-keeping purposes. At this stage, all of these bits, which we call 
"error flags", are set to zero. This reflects the fact that the lab demon has the same a priori 
knowledge about the state of the ensemble as Alice and Bob. 

In each purification step, two of the pairs are combined. The lab demon first simulates 
the noise channel (|7|) on each pair of pairs by the process described. Whenever he applies 
a a x operation to a qubit, he inverts the error flag of the corresponding pair. Alice and 
Bob then apply the 2-EPP to each pair of pairs; if the measurement results in the last 
step of the protocol coincide, the source pair will be kept. Obviously, the error flag of that 
remaining pair will also depend on the error flag of the the target pair, i. e. the error flag of 
the remaining pair is a function of the error flags of both "parent" pairs, which we call the 
flag update function. Since for binary pairs the error flag consists of one bit, there are 16 
different flag update functions in total. From these, the lab demon chooses the logical AND 
function as the flag update function, i. e. the error flag of the remaining pair is set to "1" if 
and only if both parent's error flags had the value "1". 

After each purification step, the lab demon divides all pairs into two subensembles, ac- 
cording to the value of their error flags. By a straightforward calculation, one finds for the 
coefficients A, and Bi, which completely describe the state of the pairs in the subensemble 
i, the following recurrence relations: 



A =^(/oo(^o + 24A) + fn(Bf + 2B B 1 ) 





+ UAoB, + A X B X - 


+- A B )) 


Ax 


~ (fooAj + fxxB 2 + 


- fsAtBo) 


B'o 


= ^(foo(B 2 + 2B Bx) 


+ fn(A 2 1 + 2A A 1 




+ f s (B A 1 + B 1 A 1 - 


f B A )) 


B[ 


~ (fooBl + fnA 2 + 


■ fsBxAo) 



with N = (/oo + /n)((4> + Ax) 2 + (B + Bx) 2 ) + 2f s (A + Ax)(B + B 1 ) and f s = f 01 + f 10 . 
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For the case of uncorrelated noise, 
relevant fixpoint of the map (H): 



fau — fiifui we find an analytical expression for the 



AOO 

^0 



4/ 2 -4/o+(2/o-l)v / 4^ r 3 + l 



A™ = 0, 



DOO 



2(2/ - 
0, 



(9) 



Note that, while Eq. (|9|) gives a fixpoint of (||) for / > 3/4, this does not imply that 
this fixpoint is an attractor. In order to investigate the attractor properties, we calculate 
the eigenvalues of the matrix of first derivatives, 



M 



D 



dA 



&a » 



dBi / 



(10) 



fixpoint 



We found that the modulus of the eigenvalues of this matrix is smaller than unity for 
/o rit = 0.77184451 < /o < 1, which means that in this interval, the fixpoint @ is also an 
attractor. This is in excellent agreement with a numerical evaluation of ([8]), where we found 
that 0.77182 < / crit < 0.77188. 

We also evaluated (|8]) numerically in order to investigate correlated noise (see Fig. [|). 
Like in the case of uncorrelated noise, we found that the coefficients A Q and B\ reach, 
during the distillation process, some finite value, while the coefficients A\ and Bo decrease 
exponentially fast, whenever the noise level is moderate. 

In other words, both subensembles, characterized by the value of the respective error 
flags, approach a pure state asymptotically. The pairs in the ensemble with error flag "0" 
are in the state |$ + ), while those in the ensemble with error flag "1" are in the state |^ + ). 
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FIG. 2: The evolution of the four parameters Aq, A\, Bq, and B\. Note that both A\ and Bq 
decrease exponentially fast in the number of steps. 



To conclude this section, we summarize: For a large region 0.77184451 = /g rit < fo < 1 
the 2-EPP purifies and at the same time any eavesdropper is factored out. For a small 
region 0.75 < fo < fo nt = 0.77184451, close to the threshold of the purification protocol, 
the conditional fidelity does not reach unity, while the protocol is in the purification regime. 
Even though the region is small and of little practical relevance (in this regime we are already 
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out of the repeater regime [|HJ and purification is very inefficient), its existence shows that 
the process of factorization is an independent phenomenon and not trivially connected to 
EPP. A more exhaustive description of the intermediate regime will be published elsewhere. 



C. Bell diagonal initial states 

Now we want to show that the same result is true for arbitrary Bell diagonal states 
(Eq. ([I])) and for noise of the form (^). The procedure is the same as in the case of binary 
pairs; however, a few modifications are required. 

In order to keep track of the four different error operators in @), the lab demon has 
to attach two classical bits to each pair; let us call them the phase error bit and amplitude 
error bit. Whenever a a x (a z , a y ) error occurs, the lab demon inverts the error amplitude bit 
(error phase bit, both error bits). To update these error flags, he uses the update function 
given in Tab. |). The physical reason for the choice of the flag update function will be given 
in the next section. 





(00) (01) (10) (11) 


(00) 
(01) 
(10) 

(11) 


(00) (00) (00) (10) 
(00) (01) (11) (00) 
(00) (11) (01) (00) 
(10) (00) (00) (00) 



TABLE I: The value (phase err or, amplitude error) of the updated error flag of a pair that is kept 
after a 2-EPP step, given as a function of the error flags of Pi and P2 (left to right and top to 
bottom, respectively). 



Here, the lab demon divides all pairs into four subensembles, according to the value of 
their error flag. In each of the subensembles the pairs are described by a Bell diagonal 
density operator, like in Eq. (|lj), which now depends on the subensemble. That means, in 
order to completely specify the state of all four subensembles, there are 16 real numbers 
Aij , Bij , Cij , Dij with i, j e {0,1} required, for which one obtaines recurrence relations of 
the form 



4(01) -.(01)/ ,(00) 4(01) D (ii)> 



(11) 



These generalize the recurrence relations (|8]) for the case of binary pairs, and the relations 
(0) for the case of noiseless apparatus. 

Like the recurrence relations (0) and (|8|), respectively, these relations are (modulo nor- 
malization) quadratic forms in the 16 state variables a = ( A^°\ , . . . , D^ n n , with 
coefficients that depend on the error parameters only. In other words, ([TT| ) can be 
written in the more compact form 



dMjd 



(12) 
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FIG. 3: The evolution of the extended state 



where, for each j e {1, . . . 16}, Mj is a real 16 x 16-matrix whose coefficients are polynomials 
in the noise parameters f^ u . 

D. Numerical results 



The 16 recurrence relations (|TT|) imply a reduced set of 4 recurrence relations for the 
quantities A n = YlijAn ' , ... ,D n = Z?„ which describe the evolution of the total 
ensemble (that is, the blend |2]J of the four subensembles) under the purification protocol. 
Note that these values are the only ones which are known and accessible to Alice and Bob, 



as they have no knowledge of the values of the error flags. It has been shown in [13j that 
under the action of the noisy entanglement distillation process, these quantities converge 
towards a fixpoint (Aoo, B^, Coo, Doc), where A^ = -F max is the maximal attainable fidelity 



Fig. |] shows for typical initial conditions the evolution of the 16 coefficients An°^ . . . D 
They are organized in a 4 x 4-matrix, where one direction represents the Bell state of the 
pair, and the other indicates the value of the error flag. The figure shows the state (a) at 
the beginning of the entanglement purification procedure, (b) after few purification steps, 
and (c) at the fixpoint. As one can see, initially all error flags are set to zero and the 
pairs are in a Werner state with a fidelity of 70%. After a few steps, the population of the 
diagonal elements starts to grow; however, none of the elements vanishes. At the fixpoint, 
all off-diagonal elements vanish, which means that there are strict correlations between the 
states of the pairs and their error flags. 

In order to determine how fast the state converges, we investigate two important 
quantities: the first is the fidelity F n = A n , and the second is the conditional fidelity 
F™ nd = aT ] + B [ n l) + C { n 1] + D { n 0) . Note that the first quantity is the sum over the 
four |<3> + ) components in Fig. while the latter is the sum over the four diagonal elements. 
The conditional fidelity is the fidelity which Alice and Bob would assign to the pairs if they 
knew the values of the error flags, i. e. 



ncond 



(13) 



i, j 



where pij is the non-normalized state of the subensemble of the pairs with the error flag 
For convenience, we used the phase- and spin-flip bits % and j as indices for the Pauli 
matrices, i. e. <7oo = Id, Ooi = o~ x , o~w = cr y , cr 10 = a z . 

The results that we obtain are similar to those for the binary pairs. We can also distin- 
guish three regimes of noise parameters /^„. In the high-noise regime (i.e., small values of 
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FIG. 4: (a) The fidelities F and -F con d as a function of the number of steps in the entanglement 
distillation process (analytical results (lines) and Monte Carlo simulation (circles)). For the calcu- 
lation, one and two qubit white noise with a noise fidelity of 97% has been assumed. The Monte 
Carlo simulation was started with 10000000 pairs; the numbers indicate how many pairs are left 
after each step of the distillation process. This decreasing number is the reason for the increasing 
fluctuations around the analytical curves. 



/oo); the noise level is above the threshold of the 2-EPP and the fidelity F and the con- 
ditional fidelity F cond converge both to the value 0.25. In the low-noise regime (i.e., large 
values of foo), F converges to the maximum fidelity F max and F cond converges to unity (see 
Fig. |j). This regime is the security regime, where we know that secure quantum communi- 
cation is possible. Like for binary pairs, there exists also an intermediate regime, where the 
2-EPP purines but F cond does not converge to unity. For an illustration, see Fig [|. Note that 
the size of the intermediate regime is very small, compared to the security regime. Whether 
or not secure quantum communication is possible in this regime is unknown. However, the 
answer of this question is irrelevant for all practical purposes, because in the intermediate 
regime the distillation process converges very slowly. A detailed discussion of the situation 
near the purification threshold will be published at some other place. 

Even though the intermediate regime is practically irrelevant, it is important to estimate 
its size. For simplicity, we considered the case of one-qubit white noise, i.e. = f^f u and 
fi — I2 = fs = (1 — /o)/3. Here, this regime is known to be bounded by 

0.8983 < / CTit . lowcr < f < ;crit,u PP cr < 8988 _ 

Regarding the efficiency of the distillation process, it is an important question how many 
initial pairs are needed to create one pair with the security parameter e = 1 — _p cond . Both the 
number of required initial pairs (resources) and the security parameter scale exponentially 
with the number of distillation steps, so that we expect a polynomial relation between the 
resources and the security parameter e. Fig. ^] shows this relation in a log-log plot for 
different noise parameters. The straight lines are fitted polynomial relations; the fit region 
is indicated by the lines themselves. 



IV. DISCUSSION 



We have shown in the preceeding section, that the two-way entanglement distillation 
process is able to disentangle any eavesdropper from Bell pairs distributed between Alice 
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FIG. 5: The size and the location of the three regimes of the distillation process. For fixed values 
of /oo, the remaining 15 noise parameters fn V have been choosen at random. Plotted is the relative 
frequency of finding the noise parameters in any of the three regimes as a function of /oo- 




Number N of pairs 



FIG. 6: Number N of pairs needed to create one pair with conditional fidelity F cc . The initial 
state of the pairs was of the Werner type with fidelity Fq = 85%. One- and two-qubit errors were 
assumed with noise parameters /ibit = /2bit = 0.95, 0.98, 0.99, 0.995 (from top to bottom). 
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and Bob, even in the presence of noise, i. e. when the pairs can only be purified up to a 
specific maximun fidelity -F max < 1- Alice and Bob may use them as a secure quantum 
communication channel. They are thus able to perform secure quantum communication, 
and, as a special case, secure classical communication (which is in this case equivalent to a 
key distribution scheme). 

In order to keep the argument transparent, we first considered the case where noise of 
the form (|J) is explicitly introduced by a fictious lab-demon, who keeps track of all error 
operations and performs calculations. However, using a simple indistinguishability argument 
(see Section A| ), we could show that any apparatus with the noise characteristics (|J) is 
equally secure as a situation where noise in introduced by the lab demon. This means that 
the security of the protocol does not depend on the fact whether or not anybody actually 
calculates the flag update function. It is sufficient to just use a noisy 2-EPP, in order to get 
a secure quantum channel. 

For the proof, we had to make several assumptions on the noise that acts in Alices and 
Bobs entanglement purification device. One restriction is that we only considered noise which 
is of the form (|4]). However, this restriction is only due to technical reasons; we conjecture 
that our results are also true for most general noise models of the form (0). We have also 
implicitly introduced the assumption that the eavesdropper has no additional knowledge 
about the noise process, i. e. Eve only knows the publicly known noise characteristics (|j) 
of the apparatus. This assumption would not be justified, for example, if the lab demon 
was bribed by Eve, or if Eve was able to manipulate the apparatus in Alice's and Bob's 
laboratories, for example by shining in light from an optical fiber. This concern is not 
important from a principial point of view, as the laboratories of Alice and Bob are considered 
secure by assumption. On the other hand, this concern has to be taken into account in any 
practical implementation. 
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